linux-kernel - Re: [PATCH] regmap: Fix possible double-free in regcache_rbtree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <02aa09c9-e873-c741-dfb5-9ed439cc7cea@huawei.com>
Date:   Tue, 12 Oct 2021 09:18:13 +0800
From:   Yang Yingliang <yangyingliang@...wei.com>
To:     Mark Brown <broonie@...nel.org>
CC:     <linux-kernel@...r.kernel.org>, <rafael@...nel.org>,
        <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] regmap: Fix possible double-free in
 regcache_rbtree_exit()

Hi,

On 2021/10/12 1:40, Mark Brown wrote:
> On Mon, Oct 11, 2021 at 09:55:26PM +0800, Yang Yingliang wrote:
>> In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
>> the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
>> so 'rbnode->block' points a freed memory, in the error handling path of
>> regcache_rbtree_init(), 'rbnode->block' will be freed again in
>> regcache_rbtree_exit(), KASAN will report double-free as follows:
>>
>> BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
>> Call Trace:
>>   dump_stack_lvl+0xe2/0x152
>>   print_address_description.constprop.7+0x21/0x150
>>   kasan_report_invalid_free+0x6f/0xa0
>>   __kasan_slab_free+0x125/0x140
> Please think hard before including complete backtraces in upstream
> reports, they are very large and contain almost no useful information
> relative to their size so often obscure the relevant content in your
> message. If part of the backtrace is usefully illustrative (it often is
> for search engines if nothing else) then it's usually better to pull out
> the relevant sections.
OK
>
>> Set rbnode->block to NULL when the 'present' realloc failed to fix this.
> This is not a good fix, it will both leak block and corrupt the data
> structure since now there's a NULL pointer where there should be a data
> block.  We should instead be moving the assignment of rbnode->block up
> to immediately after the reallocation has succeeded so that the data
> structure stays valid even if the second reallocation fails.
I will send a v2 later.

Thanks,
Yang